{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-46683", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-09-11T15:12:18.248Z", "datePublished": "2024-09-13T05:29:15.926Z", "dateUpdated": "2026-08-05T11:37:56.637Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:37:56.637Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: prevent UAF around preempt fence\n\nThe fence lock is part of the queue, therefore in the current design\nanything locking the fence should then also hold a ref to the queue to\nprevent the queue from being freed.\n\nHowever, currently it looks like we signal the fence and then drop the\nqueue ref, but if something is waiting on the fence, the waiter is\nkicked to wake up at some later point, where upon waking up it first\ngrabs the lock before checking the fence state. But if we have already\ndropped the queue ref, then the lock might already be freed as part of\nthe queue, leading to uaf.\n\nTo prevent this, move the fence lock into the fence itself so we don't\nrun into lifetime issues. Alternative might be to have device level\nlock, or only release the queue in the fence release callback, however\nthat might require pushing to another worker to avoid locking issues.\n\nReferences: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2454\nReferences: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2342\nReferences: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2020\n(cherry picked from commit 7116c35aacedc38be6d15bd21b2fc936eed0008b)" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is reached exclusively through xe DRM ioctls (`XE_VM_CREATE`, `XE_EXEC_QUEUE_CREATE`/`_DESTROY`, `XE_VM_BIND`) on a local device node such as /dev/dri/renderD128. No network, adjacent-network, or physical access is involved.\nAC:L - The attacker drives both sides — triggering preemption/fence signalling and dropping the queue's last reference via the destroy ioctl — and can repeat the loop indefinitely. Moreover the stale `fence->lock` pointer persists for as long as the attacker keeps BOs holding BOOKKEEP references to the fence, and `dma_fence_enable_sw_signaling()`/`dma_fence_add_callback()` take that lock unconditionally, so this is a lifetime bug rather than a tight instruction-window race; it was hit three separate times in ordinary CI runs.\nPR:L - Every ioctl on the path is marked `DRM_RENDER_ALLOW`, requiring only an open file descriptor on the render node — no DRM master, no capability, no root — which is granted to logged-in desktop users, `render`/`video` group members, GPU-enabled containers, and Android apps. LR-mode VM creation has no additional privilege gate.\nUI:N - A single unprivileged process creates the VM, the exec queue, triggers the rebind/preemption, and destroys the queue entirely on its own. No victim action of any kind is required.\nS:U - The freed object and the corrupted memory both live in the kernel's own slab allocator, so the impact stays within the kernel security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free that reads the lock word out of a freed `xe_exec_queue` in a generic kmalloc cache the attacker selects via the user-controlled `width` field, allowing the freed slot to be groomed with attacker-chosen or sensitive objects. Per kernel UAF guidance this yields a high-confidence path to kernel memory disclosure.\nI:H - The woken waiter executes `spin_lock_irqsave()` and `spin_unlock_irqrestore()` — real writes at a fixed offset — into the freed and potentially reallocated `xe_exec_queue` allocation, corrupting whichever object now occupies that slot. A UAF write into a groomable general-purpose slab cache is the classic starting point for control-flow hijack and privilege escalation.\nA:H - The UAF produces KASAN splats and crashes in practice (three separate freedesktop bug reports), and a stale nonzero value at the lock offset makes the waiter spin forever inside `spin_lock_irqsave()` with interrupts disabled, causing a hard lockup or panic. Any unprivileged user with render-node access can trigger this repeatedly." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/xe/xe_exec_queue.c", "drivers/gpu/drm/xe/xe_exec_queue_types.h", "drivers/gpu/drm/xe/xe_preempt_fence.c", "drivers/gpu/drm/xe/xe_preempt_fence_types.h" ], "versions": [ { "version": "dd08ebf6c3525a7ea2186e636df064ea47281987", "lessThan": "10081b0b0ed201f53e24bd92deb2e0f3c3e713d4", "status": "affected", "versionType": "git" }, { "version": "dd08ebf6c3525a7ea2186e636df064ea47281987", "lessThan": "730b72480e29f63fd644f5fa57c9d46109428953", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/xe/xe_exec_queue.c", "drivers/gpu/drm/xe/xe_exec_queue_types.h", "drivers/gpu/drm/xe/xe_preempt_fence.c", "drivers/gpu/drm/xe/xe_preempt_fence_types.h" ], "versions": [ { "version": "6.8", "status": "affected" }, { "version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.8", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.10.8" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.11" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/10081b0b0ed201f53e24bd92deb2e0f3c3e713d4" }, { "url": "https://git.kernel.org/stable/c/730b72480e29f63fd644f5fa57c9d46109428953" } ], "title": "drm/xe: prevent UAF around preempt fence", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2024-09-29T15:08:58.866096Z", "id": "CVE-2024-46683", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-29T15:09:13.919Z" } } ] } }